The Crack My If Can Street Challenge #3 was a fairly straight-forward "extract hashes and start cracking" problem. The hashes were Salted SHA1 inside a Berkeley DB. You could certainly have played with getting db_dump to work but it's just faster to use strings.
Showing posts with label john the ripper. Show all posts
Showing posts with label john the ripper. Show all posts
Sunday, August 11, 2013
Crack Me If You Can 2013 - Challenge 9: Part 1
I again had some fun this year playing KoreLogic's Crack Me If You Can password cracking contest at DEFCON 21. This year they separated teams between "Pros" and "Street" to make things a little more fair for individual users vs large groups. If you have any interest in password cracking then you can still download all the past 4 years of data and crack away! Huge thanks to the KoreLogic guys for putting on an excellent contest!
Of course my biggest problem is that by playing the game you don't get to really attend DEFCON so I didn't spend a lot of time cracking. You can tell my submissions were pretty much few and far between when I was back in my hotel room:
Even so I came in third place mostly because I spent a little extra time on Challenge 9 because of the point value - 250,000 points!
http://contest-2013.korelogic.com/stats_types.html:
As you can tell from the graph the scores for three of us (brad, I Cant Believe Its Not Butter, and me) jumped near the final few hours of the contest because of Challenge 9. Here's how I did it...
Of course my biggest problem is that by playing the game you don't get to really attend DEFCON so I didn't spend a lot of time cracking. You can tell my submissions were pretty much few and far between when I was back in my hotel room:
http://contest-2013.korelogic.com/stats_types.html:
Wednesday, October 24, 2012
Crack All The Hashes!
Crack All The Hashes!
A few months back I was having a discussion with a co-worker about how to effectively crack a large PWDUMP file (thousands and thousands of users and hashes). I have a bunch of manual steps I use to churn through John the Ripper, oclHashcat and Rainbowcrack that I shared. Then I asked myself, "wtf, why not make a shell script instead?"
When mubix mentioned lm2ntlm patches to JtR for helping to crack from LANMAN to NTLM I remembered that I never fully wrote up anything here about the script. Soo... here's the script!
Fork it, fix it, do whatever you want with it from https://gist.github.com/3416932
Execution is fairly straight forward. Hopefully I didn't make any glaring security holes when processing PWDUMP files. Use all your favorite precautions before or while running this.
Fork it, fix it, do whatever you want with it from https://gist.github.com/3416932
Execution is fairly straight forward. Hopefully I didn't make any glaring security holes when processing PWDUMP files. Use all your favorite precautions before or while running this.
Friday, August 05, 2011
KoreLogic 2011 Crack Me If You Can
Due to a lot of family-type things happening around the BlackHat/Defcon/CCC dates I have been unable to attend. Usually it's work that precludes the "having fun in 120 degree Las Vegas weather."
Thankfully KoreLogic has given non-attendees the chance to play in their "Crack Me If You Can" game for Defcon! Hooray! 48 hours of unadulterated power consuming, hash generating, text file management, pgp encrypting and general usage of unused computing cycles!
This year I decided to devote a few hours to this contest while the wife and baby sleep. I'll be writing some updates as I get some time on how things are going. It's now been a little over an hour since I started so here's where things stand.
On Your Mark
Pre-registration involved generating a PGP key (if you didn't already have one) and sending it off to KoreLogic's scoring server for verification. This was easy if you've spent any time doing encrypted communication exchanges.
Get Set
While I waited for the contest to start I made sure I had all my tools and systems ready. This would be the chance to help prove out the expenditure of NVidia GTX580 cards, high-end CPUs, RAID disk space, etc. Since I'm running in an even shorter timeframe (and smaller team size... of one!) early preparation was key.
Tools I planned on using:
Two hours in...
Thankfully KoreLogic has given non-attendees the chance to play in their "Crack Me If You Can" game for Defcon! Hooray! 48 hours of unadulterated power consuming, hash generating, text file management, pgp encrypting and general usage of unused computing cycles!
This year I decided to devote a few hours to this contest while the wife and baby sleep. I'll be writing some updates as I get some time on how things are going. It's now been a little over an hour since I started so here's where things stand.
On Your Mark
Pre-registration involved generating a PGP key (if you didn't already have one) and sending it off to KoreLogic's scoring server for verification. This was easy if you've spent any time doing encrypted communication exchanges.
Get Set
While I waited for the contest to start I made sure I had all my tools and systems ready. This would be the chance to help prove out the expenditure of NVidia GTX580 cards, high-end CPUs, RAID disk space, etc. Since I'm running in an even shorter timeframe (and smaller team size... of one!) early preparation was key.
Tools I planned on using:
- John the Ripper, latest jumbo patches and GPU patches if time and code permitted
- The oclHashCat suite
- Misc rainbowtables collected over the years
- Misc wordlists collected over the years
GO!
Molly wakes me up at 5:50am on Friday morning for her regular feeding... 20 minutes of extra sleep! I check my e-mail and am excited to see the encrypted contest e-mails in my inbox. A quick pgp decryption and the URLs to download are shown. Hooray!
Oops, based on the CMIYC twitter feed they had generated some weak hashes. Use the two files instead of the first one. Ok!
Down they come with wget.... Hmm, zip files. No problem! Take a peek with 'unzip -v' and the contents look pretty good. Time to get rolling...
~/korelogic-2011/test$ unzip ../2011-CrackMeIfYouCan_part1.zip
Oh. Of course it's going to be password protected. But it's pretty easy to guess if you take a step back and think about it.Archive: ../2011-CrackMeIfYouCan_part1.zipcreating: contest_tree/challenge1/[../2011-CrackMeIfYouCan_part1.zip] contest_tree/challenge1/challenge1.zip password:
Two hours in...
A long way to go still... Right now I'm basically not caring about the scoring points and going after "low-hanging passwords" using a very large dictionary, JTR's stock rules and patience. Some high scoring hashes may be cracking, I don't really know right now.. Time to feed the baby again.4066 password hashes cracked, 123780 left
Friday, June 13, 2008
MS Cache and John the Ripper
Chalk this one up to knowledge remembered, forgotten, and then remembered again!
Lately I have been playing with using our MPI John the Ripper cluster to increase the crack rate of MS Cache passwords. With a very long list of passwords, some of which I knew would be easy to crack, I set out and started the process on 20 nodes. After a few days and ZERO cracks I started to wonder what the hell was going on.
The answer is one I knew many years ago when cachedump first came on the scene. The MS Cache encryption routine's salt includes the lower case username as part of the salt! Because some of the cachedump tools take the username out of the registry as-is and don't convert the case you'll run JTR for days with an invalid salt. No cracks for you!
So we can do a couple of things here:
John The Ripper's source code is really easy to fix and the quickest to do so a simple diff against mscash_fmt.c:
And now I don't have to remember this every time! JTR will remember for me and with a cluster of 20 nodes all running around 600,000 cracks a second maybe SOMETHING will crack. :)
Lately I have been playing with using our MPI John the Ripper cluster to increase the crack rate of MS Cache passwords. With a very long list of passwords, some of which I knew would be easy to crack, I set out and started the process on 20 nodes. After a few days and ZERO cracks I started to wonder what the hell was going on.
The answer is one I knew many years ago when cachedump first came on the scene. The MS Cache encryption routine's salt includes the lower case username as part of the salt! Because some of the cachedump tools take the username out of the registry as-is and don't convert the case you'll run JTR for days with an invalid salt. No cracks for you!
So we can do a couple of things here:
- Remember this next time and manually lowercase the usernames
- Tell the authors to modify the tools we use to grab the cache hashes
- Patch the tools ourselves (if we have the sources) and give them to the author
- Modify the cracking program to always lowercase the usernames
John The Ripper's source code is really easy to fix and the quickest to do so a simple diff against mscash_fmt.c:
--- mscash_fmt.c 2008-06-13 15:56:07.000000000 -0700
+++ mscash_fmt-lower.c 2008-06-13 15:55:49.000000000 -0700
@@ -16,6 +16,7 @@
*/
#include
+#include
#include "arch.h"
#include "misc.h"
@@ -158,6 +159,9 @@
l = strlen(ciphertext);
strncpy(out, ciphertext + 2, l - PLAINTEXT_LENGTH + 1);
+ for(l=0; l < strlen(out); l++) {
+ out[l] = tolower(out[l]);
+ }
return out;
}
And now I don't have to remember this every time! JTR will remember for me and with a cluster of 20 nodes all running around 600,000 cracks a second maybe SOMETHING will crack. :)
Subscribe to:
Posts (Atom)